Fix twelve inline comments from the PR review:

- Changelogs for 35 packages incorrectly claimed preserve_original_event
  was added; those packages already had it before this series. Description
  shortened to "Add tags to ingest pipeline processors." for packages where
  nothing was added to the on_failure block.

- carbon_black_cloud/watchlist_hit: the append_related_hosts_6d9a788e
  processor appended user.domain but was gated on ctx.host?.hostname;
  guard corrected to ctx.user?.domain, matching alert_v7 and endpoint_event.

- azure/signinlogs: tag azure-json-keys-to-snake-case renamed to
  azure_json_keys_to_snake_case (hyphens to underscores).

- azure/signinlogs, darktrace/ai_analyst_alert, darktrace/model_breach_alert
  (three scripts): single-line Painless sources reformatted with source: |-
  for readability.

- amazon_security_lake/pipeline_category_discovery.yml: add missing
  trailing newline.

- claroty_ctd/event: tag script_to_drop_N/A_values_fields renamed to
  script_to_drop_NA_values_fields (slash was not a valid identifier char).

Also update fix_pipeline_tags.py --normalize to convert hyphens to
underscores in tag stems (same logic as the asterisk-stripping pass).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>